Merge pull request #226 from aykhans/ci/release-branch-pointer

ci: point Nix users at a release branch instead of main

.github/workflows/lint.yaml

@@ -24,4 +24,4 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.12.2
+          version: v2.13.2

.github/workflows/nix.yaml

@@ -21,16 +21,152 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: nix-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  # Keyed on the PR author, which is stable across the fix-up push, so the run
+  # started by that push cannot cancel the run that made it.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]' }}
+
+env:
+  SELF_HOSTED_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
+  IS_DEPENDABOT: ${{ github.actor == 'dependabot[bot]' }}
+
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
+    permissions:
+      # The only write is git push, which authenticates with the PAT that
+      # checkout persists, not with GITHUB_TOKEN.
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: ${{ inputs.ref || github.ref }}
+          # head.sha, not the merge ref: the hash is computed for the tree that
+          # gets pushed, and the run that verifies it must build that same tree.
+          ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.ref }}
+          token: ${{ (env.IS_DEPENDABOT == 'true' && secrets.DEPENDABOT) || secrets.GITHUB_TOKEN }}
+
       - uses: cachix/install-nix-action@v31
         with:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: nix build
+        id: build
+        continue-on-error: ${{ env.SELF_HOSTED_PR == 'true' }}
         run: nix build .#default --no-link --print-build-logs
+
+      - name: Recompute vendorHash
+        id: hash
+        if: steps.build.outcome == 'failure' && env.SELF_HOSTED_PR == 'true'
+        run: |
+          nix run nixpkgs#nix-update -- --flake --version=skip --no-src default
+
+          # An unchanged hash means the build broke for some other reason. Say
+          # nothing and let the job fail on the real error.
+          if git diff --quiet -- nix/package.nix; then
+            echo "stale=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "stale=true" >> "$GITHUB_OUTPUT"
+          sed -n 's/^[[:space:]]*vendorHash = "\([^"]*\)".*/hash=\1/p' nix/package.nix >> "$GITHUB_OUTPUT"
+
+      - name: Push vendorHash fix
+        if: steps.hash.outputs.stale == 'true' && env.IS_DEPENDABOT == 'true'
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+          PUSH_TOKEN: ${{ secrets.DEPENDABOT }}
+        run: |
+          if [ -z "$PUSH_TOKEN" ]; then
+            echo "::error::the DEPENDABOT push token is missing from the Dependabot secret store"
+            exit 1
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add nix/package.nix
+          git commit -m "fix(nix): update vendorHash [dependabot skip]"
+          git push origin "HEAD:refs/heads/$HEAD_REF"
+          echo "::notice::vendorHash updated and pushed; the run on the new commit decides this PR"
+
+      - name: Comment stale vendorHash
+        if: steps.hash.outputs.stale == 'true' && env.IS_DEPENDABOT != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          HASH: ${{ steps.hash.outputs.hash }}
+        run: |
+          marker='<!-- vendorhash-bot -->'
+          body=$(cat <<EOF
+          $marker
+          ### \`nix/package.nix\` vendorHash is stale
+
+          This branch changes the Go dependencies, so the vendor derivation no longer matches the pinned hash and \`nix build\` fails.
+
+          \`\`\`nix
+          vendorHash = "$HASH";
+          \`\`\`
+
+          Run \`task nix-hash\` locally and commit the result, or paste the hash above.
+          EOF
+          )
+
+          # Keep one sticky comment instead of a new one on every push. Without
+          # the explicit check a failed lookup reads as "no comment yet" and
+          # posts a duplicate; piping into head would hide the exit status.
+          if ! matches=$(gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR/comments?per_page=100" \
+                           --jq ".[] | select(.user.login == \"github-actions[bot]\" and ((.body // \"\") | contains(\"$marker\"))) | .id"); then
+            echo "::error::could not list the pull request comments"
+            exit 1
+          fi
+          id=$(printf '%s\n' "$matches" | head -n 1)
+          if [ -n "$id" ]; then
+            gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -f body="$body" >/dev/null
+          else
+            gh pr comment "$PR" --body "$body"
+          fi
+
+      # Once the hash is fixed the build passes and the step above stops running,
+      # so without this the comment keeps claiming the branch is broken under a
+      # green check.
+      - name: Resolve stale vendorHash comment
+        # Gated on the hash rather than the build: a later push can fix the hash
+        # while the build still fails for an unrelated reason, and the comment
+        # must stop blaming the vendor derivation either way. Skipped when the
+        # recompute itself errored, since then we do not know.
+        if: ${{ !cancelled() && env.SELF_HOSTED_PR == 'true' && steps.hash.outputs.stale != 'true' && steps.hash.outcome != 'failure' }}
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          BUILD: ${{ steps.build.outcome }}
+        run: |
+          marker='<!-- vendorhash-bot -->'
+          if ! matches=$(gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR/comments?per_page=100" \
+                           --jq ".[] | select(.user.login == \"github-actions[bot]\" and ((.body // \"\") | contains(\"$marker\"))) | .id"); then
+            echo "::error::could not list the pull request comments"
+            exit 1
+          fi
+          id=$(printf '%s\n' "$matches" | head -n 1)
+          [ -n "$id" ] || exit 0
+
+          if [ "$BUILD" = "success" ]; then
+            detail='`nix build` passes on this branch.'
+          else
+            detail='The build is failing for another reason; see the workflow log.'
+          fi
+          body=$(cat <<EOF
+          $marker
+          ### \`nix/package.nix\` vendorHash is up to date
+
+          $detail
+          EOF
+          )
+          gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$id" -f body="$body" >/dev/null
+
+      - name: Report build failure
+        if: ${{ !cancelled() && steps.build.outcome == 'failure' && !(env.IS_DEPENDABOT == 'true' && steps.hash.outputs.stale == 'true') }}
+        run: |
+          echo "::error file=nix/package.nix::nix build failed; see the log above"
+          exit 1

.github/workflows/release.yaml

@@ -2,20 +2,7 @@ name: Build and Release
 
 on:
   release:
-    types: [created]
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Release tag (e.g., v1.0.0)"
-        required: true
-      build_binaries:
-        description: "Build and upload binaries"
-        type: boolean
-        default: true
-      build_docker:
-        description: "Build and push Docker image"
-        type: boolean
-        default: true
+    types: [published]
 
 permissions:
   contents: write
@@ -24,27 +11,57 @@ jobs:
   nix:
     name: Verify Nix package
     uses: ./.github/workflows/nix.yaml
+    permissions:
+      contents: read
+      pull-requests: write
     with:
-      ref: ${{ inputs.tag || github.ref }}
+      ref: ${{ github.ref }}
 
-  # nix/package.nix carries its own version string that has to be bumped by
-  # hand; catch a forgotten bump before the tag ships.
+  # Gate: the tag must come from main, agree with the pre-release flag, and match
+  # the hand-bumped version in nix/package.nix.
   version:
-    name: Verify package version
+    name: Verify release
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    env:
+      TAG: ${{ github.ref_name }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
         with:
-          ref: ${{ inputs.tag || github.ref }}
+          ref: ${{ github.ref }}
+          # Full history so the tag can be located on main's first-parent line.
+          fetch-depth: 0
+
+      - name: Check the tag is on main
+        run: |
+          git fetch --no-tags origin "+refs/heads/main:refs/remotes/origin/main"
+          git rev-list --first-parent refs/remotes/origin/main > "$RUNNER_TEMP/first-parent.txt"
+          if ! grep -qxF "$GITHUB_SHA" "$RUNNER_TEMP/first-parent.txt"; then
+            echo "::error::$TAG ($GITHUB_SHA) is not on main; releases must be cut from main"
+            exit 1
+          fi
+
+      - name: Check the tag matches the pre-release flag
+        env:
+          PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          # The flag comes from the checkbox, not the tag name, so without this a
+          # tag like v1.5.0-rc1 published as stable would move :latest.
+          case "$TAG" in
+            *-*)
+              if [ "$PRERELEASE" != "true" ]; then
+                echo "::error::tag '$TAG' carries a pre-release suffix but the release is not marked as a pre-release"
+                exit 1
+              fi
+              ;;
+          esac
 
       - name: Check nix/package.nix matches the release tag
-        env:
-          TAG: ${{ inputs.tag || github.ref_name }}
         run: |
           expected="${TAG#v}"
+          expected="${expected%%-*}"
           actual="$(sed -n 's/^[[:space:]]*version = "\([^"]*\)".*/\1/p' nix/package.nix | head -1)"
           if [ -z "$actual" ]; then
             echo "::error file=nix/package.nix::could not read the version string"
@@ -65,7 +82,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7
         with:
-          ref: ${{ inputs.tag || github.ref }}
+          ref: ${{ github.ref }}
 
       - name: Set build metadata
         run: |
@@ -74,14 +91,12 @@ jobs:
           echo "GO_VERSION=1.26.5" >> $GITHUB_ENV
 
       - name: Set up Go
-        if: github.event_name == 'release' || inputs.build_binaries
         uses: actions/setup-go@v7
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
 
       - name: Build binaries
-        if: github.event_name == 'release' || inputs.build_binaries
         run: |
           LDFLAGS="-X 'go.aykhans.me/sarin/internal/version.Version=${{ env.VERSION }}' \
                    -X 'go.aykhans.me/sarin/internal/version.GitCommit=${{ env.GIT_COMMIT }}' \
@@ -99,29 +114,24 @@ jobs:
           CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags "$LDFLAGS" -o ./sarin-windows-arm64.exe ./cmd/cli/main.go
 
       - name: Upload Release Assets
-        if: github.event_name == 'release' || inputs.build_binaries
         uses: softprops/action-gh-release@v3
         with:
-          tag_name: ${{ inputs.tag || github.ref_name }}
+          tag_name: ${{ github.ref_name }}
           files: ./sarin-*
 
       - name: Set up QEMU
-        if: github.event_name == 'release' || inputs.build_docker
         uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        if: github.event_name == 'release' || inputs.build_docker
         uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Hub
-        if: github.event_name == 'release' || inputs.build_docker
         uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker image
-        if: github.event_name == 'release' || inputs.build_docker
         uses: docker/build-push-action@v7
         with:
           context: .
@@ -131,6 +141,56 @@ jobs:
             VERSION=${{ env.VERSION }}
             GIT_COMMIT=${{ env.GIT_COMMIT }}
             GO_VERSION=${{ env.GO_VERSION }}
+          # A pre-release must not take over the tag people get by default.
           tags: |
             ${{ secrets.DOCKERHUB_USERNAME }}/sarin:${{ env.VERSION }}
-            ${{ secrets.DOCKERHUB_USERNAME }}/sarin:latest
+            ${{ !github.event.release.prerelease && format('{0}/sarin:latest', secrets.DOCKERHUB_USERNAME) || '' }}
+
+  # Moving pointer at the newest stable release, so flake users can follow
+  # releases instead of main. Fast-forward only.
+  release-branch:
+    name: Advance release branch
+    needs: build
+    if: ${{ !github.event.release.prerelease }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    # Serialize: concurrent releases would otherwise race the push.
+    concurrency:
+      group: release-branch
+      cancel-in-progress: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          # The checks below compare against $GITHUB_SHA; check out exactly that.
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+
+      - name: Point release at the tag
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          # Refresh: checkout fetched this, but as of a few seconds ago.
+          git fetch --no-tags origin "+refs/heads/release:refs/remotes/origin/release" || true
+
+          if git rev-parse --verify --quiet refs/remotes/origin/release >/dev/null; then
+            # At or behind the pointer: a re-run of this or an older release.
+            if git merge-base --is-ancestor "$GITHUB_SHA" refs/remotes/origin/release; then
+              if [ "$(git rev-parse refs/remotes/origin/release)" = "$GITHUB_SHA" ]; then
+                echo "::notice::release is already at $TAG"
+              else
+                echo "::warning::release is ahead of $TAG; leaving it alone"
+              fi
+              exit 0
+            fi
+            # The version job put this commit on main, so a pointer that is neither
+            # behind nor ahead is off main history and can never fast-forward again.
+            if ! git merge-base --is-ancestor refs/remotes/origin/release "$GITHUB_SHA"; then
+              echo "::error::release ($(git rev-parse --short refs/remotes/origin/release)) has diverged from main and can no longer fast-forward to $TAG; reset it by hand"
+              exit 1
+            fi
+          fi
+
+          git push origin "$GITHUB_SHA:refs/heads/release"
+          echo "::notice::release branch now points at $TAG"

README.md

@@ -61,20 +61,20 @@ docker run --rm -it aykhans/sarin -f https://example.com/config.yaml
 Run directly without installing (requires flakes enabled):
 
 ```sh
-nix run github:aykhans/sarin -- -U http://example.com -r 100 -c 10
+nix run github:aykhans/sarin/release -- -U http://example.com -r 100 -c 10
 ```
 
 Install into your profile:
 
 ```sh
-nix profile install github:aykhans/sarin
+nix profile install github:aykhans/sarin/release
 ```
 
 Or add it to your own flake via the overlay:
 
 ```nix
 {
-  inputs.sarin.url = "github:aykhans/sarin";
+  inputs.sarin.url = "github:aykhans/sarin/release";
 
   # In your outputs, apply the overlay to nixpkgs:
   # nixpkgs.overlays = [ inputs.sarin.overlays.default ];
@@ -82,6 +82,8 @@ Or add it to your own flake via the overlay:
 }
 ```
 
+The `release` branch tracks the newest stable release cut from `main`, so `nix flake update` moves between releases rather than following every commit; pre-releases are excluded. Pin an exact release with `github:aykhans/sarin/v1.4.2`, or track development with `github:aykhans/sarin` (the `main` branch).
+
 </details>
 
 <details>

Taskfile.yaml

@@ -3,7 +3,7 @@ version: "3"
 
 vars:
   BIN_DIR: ./bin
-  GOLANGCI_LINT_VERSION: v2.12.2
+  GOLANGCI_LINT_VERSION: v2.13.2
   GOLANGCI: "{{.BIN_DIR}}/golangci-lint-{{.GOLANGCI_LINT_VERSION}}"
 
 tasks:
@@ -39,6 +39,11 @@ tasks:
     cmds:
       - "{{.GOLANGCI}} run"
 
+  nix-hash:
+    desc: Recompute nix/package.nix vendorHash after a dependency change.
+    cmds:
+      - nix run nixpkgs#nix-update -- --flake --version=skip --no-src default
+
   test:
     desc: Run Go tests.
     cmds:

flake.nix

@@ -32,7 +32,7 @@
         };
       });
 
-      # nix run github:aykhans/sarin -- <args>
+      # nix run github:aykhans/sarin/release -- <args>
       apps = forAllSystems (pkgs: {
         default = {
           type = "app";

go.mod

@@ -3,13 +3,13 @@ module go.aykhans.me/sarin
 go 1.26.5
 
 require (
-	charm.land/bubbles/v2 v2.1.1
-	charm.land/bubbletea/v2 v2.0.8
+	charm.land/bubbles/v2 v2.2.1
+	charm.land/bubbletea/v2 v2.0.9
 	charm.land/glamour/v2 v2.0.1
 	charm.land/lipgloss/v2 v2.0.6
-	github.com/brianvoe/gofakeit/v7 v7.15.0
+	github.com/brianvoe/gofakeit/v7 v7.16.0
 	github.com/charmbracelet/x/term v0.2.2
-	github.com/dop251/goja v0.0.0-20260806115107-493f22071ef6
+	github.com/dop251/goja v0.0.0-20260901132549-43234fa61381
 	github.com/joho/godotenv v1.5.1
 	github.com/valyala/fasthttp v1.73.0
 	github.com/yuin/gopher-lua v1.1.2
@@ -20,13 +20,13 @@ require (
 
 require (
 	github.com/alecthomas/chroma/v2 v2.27.0 // indirect
-	github.com/andybalholm/brotli v1.2.2 // indirect
+	github.com/andybalholm/brotli v1.2.3 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
 	github.com/charmbracelet/harmonica v0.2.0 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260902113444-043ea8a7d37d // indirect
 	github.com/charmbracelet/x/ansi v0.11.8 // indirect
-	github.com/charmbracelet/x/exp/slice v0.0.0-20260816001655-68d539dca504 // indirect
+	github.com/charmbracelet/x/exp/slice v0.0.0-20260902165432-6f6ad8b37b0a // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
@@ -34,11 +34,11 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dlclark/regexp2/v2 v2.7.1 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.4+incompatible // indirect
-	github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect
+	github.com/google/pprof v0.0.0-20260902005441-ca85771921e4 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
-	github.com/klauspost/compress v1.19.2 // indirect
+	github.com/klauspost/compress v1.20.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
-	github.com/mattn/go-runewidth v0.0.27 // indirect
+	github.com/mattn/go-runewidth v0.0.29 // indirect
 	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect

go.sum

@@ -1,7 +1,7 @@
-charm.land/bubbles/v2 v2.1.1 h1:7r55WzBxpo/R3z98hGmY7KKPd3ET6vsf0Fb9sDHOV60=
-charm.land/bubbles/v2 v2.1.1/go.mod h1:GE6M31gaWZVXzGw73OeuTTgy4lX+OtkH0E5ymnNsHxo=
-charm.land/bubbletea/v2 v2.0.8 h1:SxTJMhCAI3lbPmy4SgX5LWZ24AdINr4I6UEqzZvYJuY=
-charm.land/bubbletea/v2 v2.0.8/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
+charm.land/bubbles/v2 v2.2.1 h1:Fq1+qm5hV6GkvzLQDhCBpXXE5tLgvh1PRriCLwSvIQU=
+charm.land/bubbles/v2 v2.2.1/go.mod h1:wdMgn+sje1KNXdwFizIWjbf328fIUBxqEmJ/vYPo8yc=
+charm.land/bubbletea/v2 v2.0.9 h1:DpJCMWKgzQK8SJv4zbKKFHAI10ymWy/evClPFk0k0f8=
+charm.land/bubbletea/v2 v2.0.9/go.mod h1:2SkdgoTXluXJHOUwAoRlRXF/28vklb1rFl6GcgV1/ss=
 charm.land/glamour/v2 v2.0.1 h1:xl+r00A4aJWU0z8fgwKd9fQQ4rsphqGUzuEiXZP5n+c=
 charm.land/glamour/v2 v2.0.1/go.mod h1:jo9z8XqVKPeEFMVdvCRLGk++RyJ3CdUwgNr7EvXLw3k=
 charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
@@ -14,26 +14,26 @@ github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r
 github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
-github.com/andybalholm/brotli v1.2.2 h1:HzTuoo2ErYQqf5qvcJInB8uvqSVxRttzkFexPWtnceM=
-github.com/andybalholm/brotli v1.2.2/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.3 h1:8H1qwOkl2LPfjf3YezB90JnCliZb6SInJ/OJkEbA5NQ=
+github.com/andybalholm/brotli v1.2.3/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
 github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
-github.com/brianvoe/gofakeit/v7 v7.15.0 h1:kGLYAWN8tnmxq2PelKVK6zwpM7kMxdz9SGPH31mFkNs=
-github.com/brianvoe/gofakeit/v7 v7.15.0/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
+github.com/brianvoe/gofakeit/v7 v7.16.0 h1:LXNcvT4Klw72/hqpLNNdEWFIcP7G0VFPNsqvEIGONBE=
+github.com/brianvoe/gofakeit/v7 v7.16.0/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
 github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
 github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
 github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
 github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
-github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
-github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
+github.com/charmbracelet/ultraviolet v0.0.0-20260902113444-043ea8a7d37d h1:RtgSelzdULNQfTpvmDi+v45OmZ+BaqYQch/tC940+IQ=
+github.com/charmbracelet/ultraviolet v0.0.0-20260902113444-043ea8a7d37d/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
 github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
 github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f h1:pk6gmGpCE7F3FcjaOEKYriCvpmIN4+6OS/RD0vm4uIA=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f/go.mod h1:IfZAMTHB6XkZSeXUqriemErjAWCCzT0LwjKFYCZyw0I=
-github.com/charmbracelet/x/exp/slice v0.0.0-20260816001655-68d539dca504 h1:Z0hBPQ9hslsfpFRRdMn+4cjnb3LK6FQH58hQkXrXv0A=
-github.com/charmbracelet/x/exp/slice v0.0.0-20260816001655-68d539dca504/go.mod h1:vqEfX6xzqW1pKKZUUiFOKg0OQ7bCh54Q2vR/tserrRA=
+github.com/charmbracelet/x/exp/slice v0.0.0-20260902165432-6f6ad8b37b0a h1:V2rGRIGqWWv9BuYW2ObrtLy6uE48b+X4cAUKkUgTTBs=
+github.com/charmbracelet/x/exp/slice v0.0.0-20260902165432-6f6ad8b37b0a/go.mod h1:vqEfX6xzqW1pKKZUUiFOKg0OQ7bCh54Q2vR/tserrRA=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
 github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
 github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY=
@@ -48,26 +48,26 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2/v2 v2.7.1 h1:yqDtwI1ptXXvEUNpYTk2lad4jLtAcKqkzepn4savSk4=
 github.com/dlclark/regexp2/v2 v2.7.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
-github.com/dop251/goja v0.0.0-20260806115107-493f22071ef6 h1:Oh2rRG1un7tLlC3/NJDzKppZ4CeZGkVFJCUOTRwLpfw=
-github.com/dop251/goja v0.0.0-20260806115107-493f22071ef6/go.mod h1:LiIEzozrcvNXorsG/3+ypGqdTUAqZryhzSsqi0oU/Qg=
+github.com/dop251/goja v0.0.0-20260901132549-43234fa61381 h1:vzmJ+R9qxuaksCAB+Kn6wtGgQ01cIfKzUGwWWcX5zXI=
+github.com/dop251/goja v0.0.0-20260901132549-43234fa61381/go.mod h1:u8yZRUavu+N4EnFFy6J5fVtjE7lEcZ2YyV2GcBXY9c8=
 github.com/go-sourcemap/sourcemap v2.1.4+incompatible h1:a+iTbH5auLKxaNwQFg0B+TCYl6lbukKPc7b5x0n1s6Q=
 github.com/go-sourcemap/sourcemap v2.1.4+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
+github.com/google/pprof v0.0.0-20260902005441-ca85771921e4 h1:/6mPXfWmhv8eKck12I0YNIcIjwHtxP3YRIMKiEgTjWg=
+github.com/google/pprof v0.0.0-20260902005441-ca85771921e4/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
 github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
-github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
 github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/mattn/go-runewidth v0.0.27 h1:Feg/Oou5zI/wnpgDF6omIU0OokC9GxLC/WRknhVlIR0=
-github.com/mattn/go-runewidth v0.0.27/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
+github.com/mattn/go-runewidth v0.0.29 h1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqEPDfQ=
+github.com/mattn/go-runewidth v0.0.29/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=

nix/package.nix

@@ -7,11 +7,11 @@
 
 (buildGoModule.override { go = go_1_26; }) (finalAttrs: {
   pname = "sarin";
-  version = "1.4.2"; # bump per release
+  version = "1.4.3"; # bump per release
 
   src = lib.cleanSource ../.;
 
-  vendorHash = "sha256-hGrS/drQiBOcqwloi15vqOdiTbweo0Oya+fF9SLM3so=";
+  vendorHash = "sha256-dSPX3PVDrSyvDVZfXkoaT5VBhIBY4E5hUwwC1XhAdQ4=";
 
   subPackages = [ "cmd/cli" ];
 
@@ -29,7 +29,6 @@
     ldflags+=("-X 'go.aykhans.me/sarin/internal/version.GoVersion=$(go version)'")
   '';
 
-  # cmd/cli produces a binary named "cli"; rename it to "sarin".
   postInstall = ''
     mv $out/bin/cli $out/bin/sarin
   '';